The flaw is a heap use‑after‑free in the TransferSubscriptions service of the open62541 OPC UA library. An attacker who can authenticate to the server can trigger a use‑after‑free that may cause the server to crash, resulting in a denial of service, or, if the freed memory is replayed with malicious data, potentially execute arbitrary code within the server process. This weakness corresponding to CWE‑416 and is limited to clients that have valid authentication credentials.

The vulnerability affects the open62541 library distributed by o6 Automation. The CNA data does not list specific affected releases, so any deployments that use a pre‑fix build—prior to the commits referenced in pull requests 8235–8238—are potentially vulnerable. The fix is available in the cited GitHub commits and the new distribution released by o6 Automation.

The CVSS score of 7.2 indicates high severity, while the EPSS score is reported as < 1 %, implying a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack requires that the attacker be able to authenticate to the OPC UA server, which restricts the threat to privileged users or compromised clients. Once authenticated, the attacker can crash the server or potentially run arbitrary code with the server's process privileges.